multica-ai/multica · critical

checksum mismatch for %q: expected %s, got %s

Error message

checksum mismatch for %q: expected %s, got %s

What it means

The SHA-256 of the downloaded archive does not match the digest recorded in the release's checksums.txt. Both digests are included in the message so a corrupted asset is diagnosable without re-downloading. This is the supply-chain guard for the unattended auto-updater — a mismatch means the bytes you received are not the bytes that were published.

Source

Thrown at server/internal/cli/update.go:222

		}
	}
	if err := scanner.Err(); err != nil {
		return "", fmt.Errorf("read checksum manifest: %w", err)
	}
	return "", fmt.Errorf("checksum for %q not found in manifest", assetName)
}

// verifyAssetSHA256 returns nil when the SHA-256 of data matches the lowercase
// hex expected value, or an error otherwise. The error includes both digests
// so a corrupted asset is diagnosable from the log without re-downloading.
func verifyAssetSHA256(data []byte, expectedHex, assetName string) error {
	if expectedHex == "" {
		return fmt.Errorf("empty expected checksum for %q", assetName)
	}
	sum := sha256.Sum256(data)
	actual := hex.EncodeToString(sum[:])
	if !strings.EqualFold(actual, expectedHex) {
		return fmt.Errorf("checksum mismatch for %q: expected %s, got %s", assetName, expectedHex, actual)
	}
	return nil
}

func fetchReleaseByTag(tag string) (*GitHubRelease, error) {
	client := &http.Client{Timeout: 10 * time.Second}
	req, err := http.NewRequest(http.MethodGet, "https://api.github.com/repos/multica-ai/multica/releases/tags/"+tag, nil)
	if err != nil {
		return nil, err
	}
	req.Header.Set("Accept", "application/vnd.github+json")

	resp, err := client.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Re-run the update/download — transient corruption is the most common cause
2. Manually download the asset and checksums.txt and compare with sha256sum to confirm which side is wrong
3. If the mismatch persists on the official repo, report it: the release itself may be broken or compromised
4. Clear any caching proxy/mirror between you and github.com and retry
5. Do not skip or downgrade the verification — install the binary manually only after independently verifying its digest

Example fix

$ curl -LO https://github.com/multica-ai/multica/releases/download/v1.2.3/multica-cli-1.2.3-linux-amd64.tar.gz
$ curl -LO https://github.com/multica-ai/multica/releases/download/v1.2.3/checksums.txt
$ sha256sum -c checksums.txt --ignore-missing

sum := sha256.Sum256(data)
actual := hex.EncodeToString(sum[:])
if !strings.EqualFold(actual, expected) {
	// do not exec or install; retry the download once
}

err := cli.VerifyAssetSHA256(data, expected, name) // or equivalent
if err != nil && strings.Contains(err.Error(), "checksum mismatch") {
	data, dataErr := refetchAsset(url)
	if dataErr == nil {
		err = cli.VerifyAssetSHA256(data, expected, name)
	}
	if err != nil { /* quarantine: possible supply-chain compromise */ }
}

When it happens

Trigger: A truncated or corrupted download (network proxy, flaky connection, mirror tampering), or a checksums.txt that belongs to a different version of the asset than the one downloaded.

Common situations: Corporate proxies that mangle binary downloads; CDN cache poisoning or a compromised mirror; downloading asset and manifest from two different release tags in a race; disk corruption mid-write.

Related errors

• checksum manifest %q not present in release
• checksum for %q not found in manifest
• empty expected checksum for %q
• read checksum manifest: %w
• download checksum manifest: %w

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/7e351f04e6be61c6. Report an issue: GitHub.